CVE-2026-114551

Overview

MailEnable stores mailbox credentials in plaintext, allowing remote attackers to read sensitive data without authentication. The flaw can be combined with other weaknesses to obtain stored credentials and potentially compromise accounts. This vulnerability affects all MailEnable installations that use the default credential storage mechanism.

Description

MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of mailbox credentials. The issue results from storing sensitive information in plaintext. An attacker can leverage this in conjunction with other vulnerabilities to disclose stored credentials, leading to further compromise. Was ZDI-CAN-34478.

Impact

Confidentiality is compromised as attackers can read stored usernames and passwords. Integrity is at risk if attackers modify credentials. Availability is not directly affected. Network administrators and security teams are the primary stakeholders impacted.

Remediation

Apply the vendor-supplied patch or upgrade to the latest MailEnable version that encrypts credential storage. If patching is delayed, enforce strong password policies, rotate credentials, and disable any features that expose plaintext credentials. Monitor logs for unusual authentication activity and consider network segmentation to limit exposure.

Risk context

The CVE has a medium severity rating (CVSS 5.9) and no EPSS data is available, indicating a moderate but non-critical risk that should be addressed promptly but does not represent an immediate emergency.

Affected products

• MailEnable